@githolon/dsl 0.98.1 → 0.98.3

package/dart/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 0.61.3
+
+- cloudBound seeds the KEYLESS enroll-once delegation (mintKeylessDelegation) so a keyless private home
+  is born with a well-formed cert chain (was: platform_cert in the delegation slot → self-refusal).
+
 ## 0.61.2
 
 - cloudBound works against PRIVATE platforms/homes (declared read caps — the co2 shape): the device

package/dart/lib/src/test_harness.dart

@@ -835,6 +835,22 @@ class NomosTestHarness {
             if (idpToken.isEmpty || issuer.isEmpty) {
               throw NomosTestHarnessException('cloudBound: /dev/mint-token returned no token — is the test cloud started with platform:/deployJsonPath: and a law composing setAuthProvider?');
             }
+            // THE KEYLESS ENROLL-ONCE DELEGATION (links[1] of the home cert chain) — device-self-signed,
+            // its authority the dev-IdP token. enrollFirstDevice SEEDS it as the user's SignerDelegation, so
+            // birthHome's offer-effect assembles a WELL-FORMED chain [home_cert, u_delegation, …platform…].
+            // WITHOUT it the platform holds no delegation for the owner, the assembly falls to the
+            // no-delegation branch, the platform_cert lands in the delegation slot, and the home refuses at
+            // its OWN verify door ("home cert founder != delegation cert founder").
+            final delegationCert = await plane.mintKeylessDelegation({
+              'user': subject,
+              'deviceKey': publicB64,
+              'childName': _homeNameOf(subject),
+              'parentId': platformWorkspace,
+              'verifiedVia': issuer,
+              'idpToken': idpToken,
+              'capturedClock': DateTime.now().toUtc().millisecondsSinceEpoch,
+              'epoch': 0,
+            }, secret);
             await post('/v2/workspaces/$platformWorkspace/enrollFirstDevice', {
               'keyHash': keyHash,
               'verifiedVia': issuer,
@@ -843,6 +859,7 @@ class NomosTestHarness {
               'idpToken': idpToken,
               'actor': subject,
               'authorSecret': secret,
+              'delegationCert': jsonEncode(delegationCert),
             }, headers: {'x-nomos-auth': idpToken});
             return (publicB64: publicB64, secret: secret, keyHash: keyHash, idpToken: idpToken);
           });

package/dart/lib/src/webview_bridge.dart

@@ -1829,6 +1829,20 @@ class NomosBridge {
       }))['cert'] as Map<String, Object?>? ??
       const {};
 
+  /// MINT THE KEYLESS ENROLL-ONCE DELEGATION (`enrollFirstDevice.delegationCert`, the verified-first-device
+  /// lane). The device SELF-signs it; its authority is the carried `idpToken` (the kernel re-verifies that to
+  /// the platform's AuthProvider at every lane), so no S_P/admin signature is needed. [spec] carries
+  /// `{user, deviceKey, childName, parentId, verifiedVia, idpToken, capturedClock, epoch}`. WITHOUT this the
+  /// keyless home is born with a malformed cert chain (the platform_cert falls into the delegation slot →
+  /// `home cert founder != delegation cert founder` at the home's own verify door).
+  Future<Map<String, Object?>> mintKeylessDelegation(
+          Map<String, Object?> spec, String deviceSecret) async =>
+      _asMap(await _call('mintKeylessDelegation', {
+        'spec': spec,
+        'deviceSecret': deviceSecret,
+      }))['cert'] as Map<String, Object?>? ??
+      const {};
+
   /// ENROLL THIS DEVICE — the LIVE gate: bind a device key's PUBLIC half to `principal` on-chain as a
   /// `signer` so the holon's gate can PROVE this device's authorship on replay (and the VA chain attest it).
   /// `publicKey` is the base64 PUBLIC half (from [mintDeviceKey]); `authToken` (defaults to the connect-time

package/dart/pubspec.yaml

@@ -11,7 +11,7 @@ description: >-
   Nomos 2 Dart frontend types — the hand-written kernel wire types plus the
   code-generated per-domain aggregate + directive-payload types. (De)serializes
   the EXACT serde JSON the Rust kernel + projection produce/consume.
-version: 0.61.2
+version: 0.61.3
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.98.1",
+  "version": "0.98.3",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/framework/home.ts

@@ -231,6 +231,30 @@ export const birthHome = directive("birthHome")
   .plan((p) => {
     const founder = p.owner; // the actor for the child's own genesis steps (its self-bound owner subject)
     const homeName = homeNameOf(p.owner); // workspace name == seeded homeName — derived from the SAME owner
+    // THE PARENT'S DECLARED VERIFIER (one captured read serves BOTH consumers below): the inherited
+    // `setAuthProvider` genesis step AND the enroll step's `verifiedVia` provenance stamp. Read it up
+    // front so the enroll step (which precedes the inheritance step in the chain) can see the issuer.
+    const apRows = p.inheritAuthProvider !== false
+      ? readFrameworkDeclared<Array<Record<string, unknown>>>("authProvider", { scope: "platform" })
+      : undefined;
+    const apRaw = Array.isArray(apRows) && apRows.length > 0 ? apRows[0] : undefined;
+    // Projected rows are `{type,id,data:{…fields}}`; folded shapes may be flat — accept both.
+    const ap = (apRaw && typeof apRaw === "object" && typeof (apRaw as { data?: unknown }).data === "object"
+      ? (apRaw as { data: Record<string, unknown> }).data
+      : apRaw) as Record<string, unknown> | undefined;
+    const apStr = (k: string): string | undefined => {
+      const v = ap?.[k];
+      return typeof v === "string" && v.length > 0 ? v : undefined;
+    };
+    // PROVENANCE (the verified-lineage thread, 2026-07-16): the kernel derives every later write's
+    // `principal_verified` from the ENROLL LEAF's `verifiedVia` — so a verified birth must stamp it or the
+    // born home's owner writes UNVERIFIED forever (and its own children are then born `verified:false`,
+    // whose chains refuse `verify_to_root`). The cert's `verified` IS the gate verdict post-admission
+    // (assemble_birth_attestation CAS-refuses a mismatch), so reading it in-plan is trustworthy — a lying
+    // cert never reaches this fold. An unverified birth stamps nothing (the unverified lane stays honest).
+    let certVerified = false;
+    try { certVerified = p.homeCert !== undefined && JSON.parse(p.homeCert).verified === true; } catch { /* malformed cert ⇒ unverified (the gate will refuse the birth anyway) */ }
+    const verifiedVia = certVerified ? apStr("issuer") : undefined;
     const genesisChain: Array<{ domain: string; directiveId: string; actor: string; payload: Record<string, unknown>; domainHash?: string; domainPackageB64?: string }> = [
       // THE ORDER-DECLARED LAW INSTALL: two layers, bytes-by-hash (empty package — the kernel resolves them
       // from the parent's custody when it folds the birth; never the host). Matches buildGenesisChain's shape.
@@ -248,22 +272,13 @@ export const birthHome = directive("birthHome")
       // ladder: every seed runs UNSIGNED on the still-warrant-free prefix; the warrant closes it). ERA-SAFE: a
       // home born earlier (pre-feature law, no such step in its recipe) replays byte-identical — the era rule
       // rides the LAW hash, not this branch.
-      { domain: HOME_LAW_DOMAIN, directiveId: "enrollSigner", actor: founder, payload: { keyHash: p.ownerKeyHash, grantedBy: p.owner, grantedAt: 1 } },
+      { domain: HOME_LAW_DOMAIN, directiveId: "enrollSigner", actor: founder, payload: { keyHash: p.ownerKeyHash, grantedBy: p.owner, grantedAt: 1, ...(verifiedVia !== undefined ? { verifiedVia } : {}) } },
     ];
-    // AUTHPROVIDER INHERITANCE (default ON — see the payload doc): read the PARENT's declared provider
-    // (captured read, re-derived at the gate) and copy it AS DATA into the child genesis. The child owns
-    // the copy as its own law-state; nothing is inherited-by-reference. Opt out: `inheritAuthProvider: false`.
+    // AUTHPROVIDER INHERITANCE (default ON — see the payload doc): copy the parent's declared provider
+    // (the up-front captured read above) AS DATA into the child genesis. The child owns the copy as its
+    // own law-state; nothing is inherited-by-reference. Opt out: `inheritAuthProvider: false`.
     if (p.inheritAuthProvider !== false) {
-      const rows = readFrameworkDeclared<Array<Record<string, unknown>>>("authProvider", { scope: "platform" });
-      const raw = Array.isArray(rows) && rows.length > 0 ? rows[0] : undefined;
-      // Projected rows are `{type,id,data:{…fields}}`; folded shapes may be flat — accept both.
-      const ap = (raw && typeof raw === "object" && typeof (raw as { data?: unknown }).data === "object"
-        ? (raw as { data: Record<string, unknown> }).data
-        : raw) as Record<string, unknown> | undefined;
-      const str = (k: string): string | undefined => {
-        const v = ap?.[k];
-        return typeof v === "string" && v.length > 0 ? v : undefined;
-      };
+      const str = apStr;
       const issuer = str("issuer");
       if (issuer !== undefined) {
         genesisChain.push({

package/src/framework/signing_identity.ts

@@ -212,6 +212,14 @@ export const enrollSigner = directive("enrollSigner")
       keyHash: sha256Hex, // sha256hex of the ed25519 device PUBLIC key
       grantedBy: z.string().min(1),
       grantedAt: z.number().int().nonnegative(), // epoch ms, caller-stamped (determinism)
+      /** OPTIONAL PROVENANCE — the IdP/issuer that VOUCHED for this principal at the enrolling birth.
+       *  The kernel's `verify_captured_principal` derives `principal_verified` from THIS leaf field on
+       *  every later write, so a genesis enroll that omits it leaves the workspace's owner permanently
+       *  UNVERIFIED (their children are then born `verified:false` and their chains refuse
+       *  `verify_to_root` — the 2026-07-16 estate holarchy RED). Birth recipes stamp it from the
+       *  CAS-verified birth cert (`cert.verified` IS the gate verdict post-admission) + the inherited
+       *  AuthProvider issuer; an unverified birth omits it (the unverified lane stays honest). */
+      verifiedVia: z.string().min(1).optional(),
     }),
   )
   .plan((p, ctx) => {
@@ -227,6 +235,7 @@ export const enrollSigner = directive("enrollSigner")
       subject: "key:" + p.keyHash,
       grantedBy: p.grantedBy,
       grantedAt: String(p.grantedAt),
+      ...(p.verifiedVia !== undefined ? { verifiedVia: p.verifiedVia } : {}),
     });
   });
 

package/src/index.ts

@@ -416,6 +416,15 @@ export {
   type SignerEpochHandle,
   type SignerAuthority,
 } from "./framework/signing_identity.js";
+// THE WORKSPACE VERIFIER is framework-owned law-state. Ordinary birth/onboarding flows compose and
+// inherit it automatically; these exports exist for governance and acceptance laws that need to author
+// the provider explicitly, without re-declaring the kernel's security schema in tenant code.
+export {
+  AUTH_PROVIDER_ID,
+  AuthProvider,
+  setAuthProvider,
+  authProvider,
+} from "./framework/auth_provider_law.js";
 // THE HOME HOLON (home_holons_and_cross_custody.md §4) — the identity-role law: the shared-with-me access
 // index + the owner lane to maintain it (the key directory is the `signer` relation above).
 export {